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Amendments to the claims: 



Please amend the claims as indicated below. Added text 
is underlined and deleted text is either struck through or 
shown in double enclosing brackets. Applicant avers that no 
new matter has been added. 

1. (currently amended) A method to categorize e-mail 
messages received in a network, the method comprising: 

a) receiving information about an e-mail message sent 
to a recipient within an e-mail network, the received 
information including at least one of the following! [:] ] 

i) an actual sender of the e-mail message; 

ii) a final IP address used by the sender ; 

iii) a final domain name used by the sender; and 

iv) an IP path used by the sender ; 

b) storing the information; and 

c) calculating statistics based on the stored 
information [[,]]_£_ 

d) using the calculated statistics being used to 

determine whether the received e-mail is unsolicited e-mailj_ 
and 

e) setting a predetermined threshold for accepting 

messages based on statistics associated with one of the 
following 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path . 
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2. (previously presented) The method of claim 1 wherein the 
actual sender is identified by a signature that includes at 
least two of the following fields from a message header: 

a) an e-mail address used by the sender; 

b) a display name used by the sender; 

c) a domain name used by the sender ; 

d) the final IP address used by the sender; 

e) the final domain name used by the sender; 

f) a client software name used by the actual sender; 

g) user-agent; 

h) timezone ; 

i) source IP address; 

j) sendmail version used by a first receiver; and 
k) the IP path used to route the message. 

3. (currently amended) The method of claim 1 wherein the 
actual sender is identified by a signature including a range 
of IP addresses and at least one of the following fields from 
a message header: 

a) an e-mail address used by the sender; 

b) a display name used by the sender; 

c) a domain name used by the sender; 

d) the final IP address used by the sender ; 

e) the final domain name used by the sender ; 

f) the name — o# a client software name used by the 
actual sender; 

g) user-agent; 

h) timezone ; 

i) source IP address; 

j) sendmail version used by a first receiver; and 

k) the IP path used to route the message. 
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4 . (previously presented) The method of claim 44 further 
comprising storing information about received messages in the 
at least one database, the information including at least two 
of the following: 

a) information identifying the actual sender; 

b) whether the actual sender is included on a 
recipient ' s whitelist ; 

c) whether the actual sender is included on a 
recipient ' s blacklist ; 

d) information identifying the final IP address ; 

e) whether the final IP address is included on the 
recipient ' s whitelist ; 

f) whether the final IP address is included on the 
recipient ' s blacklist ; 

g) information identifying the final domain name; 

h) whether the final domain name is included on the 
recipient ' s whitelist ; 

i) whether the final domain name is included on the 
recipient ' s blacklist ; 

j ) information identifying the IP path; 

k) whether the IP path is included on the recipient's 
whitelist ; 

1) whether the IP path is included on the recipient's 
blackl ist ; 

m) whether the message could be categorized locally; 

and 

n) whether a recipient changed a whitelist/blacklist 
status of the message. 
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5. (currently amended) The method of claim 1 further 
comprisingj_ 

storing the recipient statistics about at least one of 
the following: 

a) [[an]] the actual sender ; 

b) [[a]] the final IP address; 

c) [[a]] the final domain name; 

d) [[an]] the IP path. 

6. (previously presented) The method of claim 1 wherein 
information stored about the actual sender includes at least 
one of the following: 

a) a total number of messages sent; 

b) a number of messages sent over a first predetermined 
time period; 

c) a total number of messages sent to recipients in the 
network who have included the actual sender on a whitelist; 

d) a number of messages sent to recipients in the 
network who have included the actual sender on the whitelist 
over a second predetermined time period; 

e) a number of recipients who know the actual sender; 

f ) a total number of times a recipient changed 
whitelist/blacklist status of the actual sender; 

g) a number of times any recipient changed the actual 
sender's whitelist/blacklist status over a third predetermined 
time period; 

h) a total number of messages sent to recipients in the 
network who don't know the actual sender; 

i) a number of messages sent to recipients in the 
network who don't know the actual sender over a fourth 
predetermined time period; 

j ) a total number of unique recipients in the network 
who have received at least one message from the actual sender; 

k) a total number of messages sent to unique recipients 
in a network who have included the actual sender on a 
whitelist; and 
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1) a total number of messages sent to unique recipients 
in the network who have not included the actual sender on the 
whitelist . 

7, (original) The method of claim 1 wherein information 
stored about messages sent from a final IP address includes at 
least one of the following: 

a) a total number of messages sent; 

b) a number of messages sent over a first predetermined 
time period; 

c) a total number of messages sent to recipients in the 
network who have included a sender on a whitelist ; 

d) a number of messages sent to recipients in the 
network who have included the sender on the whitelist over a 
second predetermined time period; 

e) a number of recipients who have whitelisted senders 
having the final IP address; 

f) a total number of times a recipient changed a 
whitelist/blacklist status of any sender using the final IP 
address ; 

g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the final IP 
address over a third predetermined time period; 

h) a total number of messages sent to recipients in the 
network who have not included the sender on the whitelist; 

i) a number of messages sent to recipients in the 
network who have not included the sender on the whitelist over 
a fourth predetermined time period; 

j ) a total number of unique recipients in the network 
who have received at least one message from at least one 
sender using the final IP address; 

k) a total number of messages sent to unique recipients 
in the network who have included the sender on the whitelist; 
and 

1) a total number of messages sent to unique recipients 
in the network who have not included the sender on the 
whitelist . 
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8. (original) The method of claim 1 wherein information stored 
about messages sent from a final domain name includes at least 
one of the following: 

a) a total number of messages sent; 

b) a number of messages sent over a first predetermined 
time period; 

c) a total number of messages sent to recipients in a 
network who have included a sender on a whitelist; 

d) a number of messages sent to recipients in the 
network who have included the sender on the whitelist over a 
second predetermined time period; 

e) a number of recipients who have whitelisted senders 
using the final domain name; 

f) a total number of times a recipient changed a 
whitelist/blacklist status of any sender using the final 
domain name; 

g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the final 
domain name over a third predetermined time period; 

h) a total number of messages sent to recipients in the 
network who have not included the sender on the whitelist; 

i) a number of messages sent to recipients in the 
network who have not included the sender on the whitelist over 
a fourth predetermined time period; 

j) a total number of unique recipients in the network 
who have received at least one message from at least one 
sender using the final domain name; 

k) a total number of messages sent to unique recipients 
in the network who have included the sender on the whitelist; 
and 

1) a total number of messages sent to unique recipients 
in the network who have not included the sender on the 
whitelist . 



A6 :ABC-00 8.AAF 



- 8 - 

9. (original) The method of claim 1 wherein information 
stored about messages sent using an IP path includes at least 
one of the following: 

a) a total number of messages sent ; 

b) a number of messages sent over a first predetermined 
time period; 

c) a total number of messages sent to recipients in the 
network who have included a sender on a whitelist; 

d) a number of messages sent to recipients in the 
network who have included the sender on the whitelist over a 
second predetermined time period; 

e) a number of recipients who have whitelisted senders 
using the IP path; 

f) a total number of times a recipient changed a 
whitelist/blacklist status of any sender using the IP path; 

g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the IP path 
over a third predetermined time period; 

h) a total number of messages sent to recipients in the 
network who have not included the sender on the whitelist; 

i) a number of messages sent to recipients in the 
network who have not included the sender on the whitelist over 
a fourth predetermined time period; 

j ) a total number of unique recipients in the network 
who have received at least one message from at least one 
sender using the IP path; 

k) a total number of messages sent to unique recipients 
in the network who have included the sender on the whitelist; 
and 

1) a total number of messages sent to unique recipients 
in the network who have not included the sender on the 
whitelist . 
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10. (currently amended) The method of claim 1 wherein the 
step of calculating statistics includes at least one of the 
following : 

a) determining a ratio of a first number of e-mail 
messages sent by an actual sender to recipients in the network 
who have included the sender on the whitelist in a 
predetermined time period divided by a second number of e-mail 
messages sent by an actual sender to users in the network in 
the predetermined time period; 

b) determining a ratio of a first number of recipients 
in the network who have included the sender on the whitelist 
divided by a second number of unique recipients in the network 
who received e-mails from the actual sender in a predetermined 
time period; 

c) determining a ratio of a first number of times in a 
predetermined time interval a message from the actual sender 
was moved from a whitelist to a blacklist divided by a second 
number of times a message from the actual sender was moved 
from a whitelist to a blacklist ; 

d) determining a ratio of a first number of times in a 
predetermined time interval a message from the actual sender 
was moved from a blacklist to a whitelist divided by a second 
number of times a message from the actual sender was moved 
from a blacklist to a whitelist; 

e) determining a ratio of a first number of unique 
users within the network who whitelisted the actual sender 
within a predetermined time period compared to a second number 
of unique users within the network who blacklisted the actual 
sender within the predetermined time period; 

f) determining a ratio reflecting whether the actual 
sender sends a majority of messages to recipients who have 
included the actual sender on the whitelist; 

g) determining a ratio reflecting a first number of 
wanted messages sent by the actual sender compared to a second 
number of unwanted or total messages sent by the actual 
sender ; 
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li) determining a difference between a first number of 
expected messages sent by the actual sender and a second 
number of unexpected [ [ed] ] messages sent by the actual 
sender; 

i) determining a difference between a first number of 
times a user whitelisted a messages the actual sender and a 
second number of times a user blacklisted a message from the 
actual sender; 

j) determining a difference reflecting whether the 
actual sender sends a majority of messages to known 
recipients ; 

k) converting any of the above ratios or differences to 
a score indicating the likelihood the message is unsolicited 
e-mail; and 

1) applying the score to the appropriate message in the 
spam folder. 

11. (currently amended) The method of claim 1 wherein the 
step of calculating statistics includes at least one of the 
following : 

a) determining a ratio of a first number of e-mail 
messages sent by any sender using a final IP address to 
recipients in the network who have included the sender on the 
whitelist in a predetermined time period divided by a second 
number of e-mail messages sent by an any sender using the 
final IP address to users in the network in the predetermined 
time period; 

b) determining a ratio of a first number of recipients 
in the network who have included the sender on the whitelist 
divided by a second number of unique recipients in the network 
who received e-mails from any sender using the final IP 
address in a predetermined time period; 

c) determining a ratio of a first number of times in a 
predetermined time interval a message from any sender using 
the final IP address was moved from a whitelist to a blacklist 
divided by a second number of times a message from any sender 
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using the final IP address was moved from a whitelist to a 
blacklist ; 

d) determining a ratio of a first number of times in a 
predetermined time interval a message from any sender using 
the final IP address was moved from a blacklist to a whitelist 
divided by a second number of times a message from any sender 
using the final IP address was moved from a blacklist to a 
whitelist ; 

e) determining a ratio of a first number of unique users 
within the network who whitelisted any sender using the final 
IP address within a predetermined time period compared to a 
second number of unique users within the network who 
blacklisted any sender using the final IP address within the 
predetermined time period; 

f) determining a ratio reflecting whether any sender 
using the final IP address sends a majority of messages to 
recipients who have included the sender on the whitelist; 

g) determining a ratio reflecting a first number of 
wanted messages sent by any sender using the final IP address 
compared to a second number of unwanted or total messages sent 
by any sender using the final IP address; 

h) determining a difference between a first number of 
expected messages sent by any sender using the final IP 
address and a second number of unexpected messages sent by any 
sender using the final IP address; 

i) determining a difference between a first number of 
times a user whitelisted a message from any sender using the 
final IP address and a second number of times a user 
blacklisted a message from any sender using the final IP 
address ; 

j) determining a difference reflecting whether any 
sender using the final IP address sends a majority of messages 
to recipients who have included the sender on the whitelist; 

k) converting any of the above ratios or differences to 
a score indicating the likelihood the message is unsolicited 
e-mail; and 
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1) applying the score to the appropriate message in the 
spam folder. 

12 . (currently amended) The method of claim 1 wherein the 
step of calculating statistics includes at least one of the 
following : 

a) determining a ratio of a first of number e-mail 
messages sent by any sender using a final domain name to 
recipients in the network who have included the sender on the 
whitelist in a predetermined time period divided by a second 
number of e-mail messages sent by an any sender using the 
final domain name to users in the network in the predetermined 
time period; 

b) determining a ratio of a first number of recipients 
in the network who have included the sender on the whitelist 
divided by a second number of unique recipients in the network 
who received e-mails from any sender using the final domain 
name in a predetermined time period; 

c) determining a ratio of a first number of times in a 
predetermined time interval a message from any sender using 
the final domain name was moved from a whitelist to a 
blacklist divided by a second number of times a message from 
any sender using the final domain name was moved from a 
whitelist to a blacklist; 

d) determining a ratio of a first number of times in a 
predetermined time interval a message from any sender using 
the final domain name was moved from a blacklist to a 
whitelist divided by a second number of times a message from 
any sender using the final domain name was moved from a 
blacklist to a whitelist; 

e) determining a ratio of a first number of unique users 
within the network who whitelisted any sender using the final 
domain name within a predetermined time period compared to a 
second number of unique users within the network who 
blacklisted any sender using the final domain name within the 
predetermined time period; 
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f) determining a ratio reflecting whether any sender 
using the final domain name sends a majority of messages to 
recipients who have included the sender on the whitelist ; 

g) determining a ratio reflecting a first number of 
wanted messages sent by any sender using the final domain name 
compared to a second number of unwanted or total messages sent 
by any sender using the final domain name; 

h) determining a difference between a first number of 
wanted messages sent by any sender using the final domain name 
and a second number of unexpected messages sent by any sender 
using the final domain name; 

i) determining a difference between a first number of 
times a user whitelisted a message from any sender using the 
final domain name and a second number of times a user 
blacklisted a message from any sender using the final domain 
name ; 

j) determining a difference reflecting whether any 
sender using the final domain name sends a majority of 
messages to recipients who have included the sender on the 
whitelist ; 

k) converting any of the above ratios or differences to 
a score indicating the likelihood the message is unsolicited 
e-mail; and 

1) applying the score to the appropriate message in the 
spam folder. 
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13 . (currently amended) The method of claim 1 wherein the 
step of calculating statistics includes at least one of the 
following : 

a) determining a ratio of a first number of e-mail 
messages sent by any sender using an IP path to recipients in 
the network who have included the sender on the whitelist in a 
predetermined time period divided by a second number of e-mail 
messages sent by an any sender using the IP path to users in 
the network in the predetermined time period; 

b) determining a ratio of a first number of recipients 
in the network who have included the sender on the whitelist 
divided by a second number of unique recipients in the network 
who received e-mails from any sender using the IP path in a 
predetermined time period; 

c) determining a ratio of a first number of times in a 
predetermined time interval a message from any sender using 
the IP path was moved from a whitelist to a blacklist divided 
by a second number of times a message from any sender using 
the IP path was moved from a whitelist to a blacklist ; 

d) determining a ratio of a first number of times in a 
predetermined time interval a message from any sender using 
the IP path was moved from a blacklist to a whitelist divided 
by a second number of times a message from any sender using 
the IP path was moved from a blacklist to a whitelist; 

e) determining a ratio of a first number of unique 
users within the network who whitelisted any sender using the 
IP path within a predetermined time period compared to a 
second number of unique users within the network who 
blacklisted any sender using the IP path within the 
predetermined time period; 

f) determining a ratio reflecting whether any sender 
using the IP path sends a majority of messages to recipients 
who have included the sender on the whitelist; 
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g) determining a ratio reflecting a first number of 
wanted messages sent by any sender using the IP path compared 
to a second number of unwanted or total messages sent by any 
sender using the IP path; 

h) determining a difference between a first number of 
expected messages sent by any sender using the IP path and a 
second number of unexpected messages sent by any sender using 
the IP path; 

i) determining a difference between a first number of 
times a user whitelisted a message from any sender using the 
IP path and a second number of times a user blacklisted a 
message from any sender using the IP path; 

j) determining a difference reflecting whether any 
sender using the IP path sends a majority of messages to 
recipients who have included the sender on the whitelist; 

k) converting any of the above ratios or differences to 
a score indicating the likelihood the message is unsolicited 
e-mail; and 

1) applying the score to the appropriate message in the 
spam folder. 

14. (original) The method of claim 1 further comprising 
revising statistics when a recipient changes a 
whitelist/blacklist status of one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 

15 . (canceled) 

16. (currently amended) The method of claim [[15]] IL further 
comprising accepting messages when information about the 
message exceeds the predetermined threshold. 
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17. (currently amended) The method of claim [[15]] 1 further 
compr i sing_^ 

setting a low threshold to differentiate wanted messages 
from unsolicited messages, wherein the low threshold is 
either : 

a) greater than one percent of a number of messages 
that are accepted, wherein the messages are characterized by 
one of the f ollowing [ [ : ] ] 

i) an actual sender ; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path; 

b) greater than one percent of a number of unique users 
accepting a message characterized by one of the f ollowing [[:] ] 

i) an actual sender; 

ii) a final IP address ; 

iii) a final domain name; or 

iv) an IP path. 

18. (original) The method of claim 1 further comprising 
monitoring a recipient's spam folder at predetermined 
intervals to determine whether messages should be released. 

19. (currently amended) The method of claim 18 further 
c omp r i s i ngj^ 

automatically releasing the message from the spam folder 
when the reputation of one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path; 

passes [[a]] the predetermined threshold. 
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20. (original) The method of claim 18 further comprising 
reevaluating the spam folder immediately before it is 
displayed to the recipient such that information about 
messages in the spam folder is current when viewed by the 
recipient . 

21. (currently amended) The method of claim 14 further 
comprising performing ; when revising the statistics, more 
heavily weighting a manual reversal of the whitelist/blacklist 
status of one of the following: 

a) an actual sender; 

b) a final IP address ; 

c) a final domain name; or 

d) an IP path; 

is more heavily weighted when rcvioing the — otatiotico . 

22. (original) The method of claim 5 wherein information 
about at least one of the following: 

a) the final IP address; 

b) the final domain name; and 

c) the IP path; 

is sent to the recipient when there is insufficient 
information about the actual sender. 

23 . (previously presented) The method of claim 1 further 
comprising using the calculated statistics to compute a score 
indicating a likelihood that the received message is 
unsolicited e-mail . 

24. (currently amended) The method of claim [[15]] 1. further 
comprising each user setting a predetermined personalized spam 
threshold, wherein an incoming message that exceeds the spam 
threshold is sent to a folder designated to hold spam 
messages . 
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25. (currently amended) The method of claim [[15]] 1 further 
comprising each user setting a predetermined personalized 
delete threshold, wherein an incoming message that exceeds the 
delete threshold is deleted. 

26. (previously presented) The method of claim 1 further 
comprising maintaining at least four of the following values: 

a) a number of messages which were explicitly ranked 

good; 

b) a number of messages which were implicitly ranked 

good; 

c) a number of messages whose ranking is unknown; 

d) a number of messages which were explicitly ranked 
bad ; and 

e) a number of messages which were implicitly ranked 

bad; 

wherein the values are based on messages having the same 
information about the sender including one of the following: 

i) an actual sender; 

ii) a final IP address used by the sender; 

iii) a final domain name used by the sender; or 

iv) an IP path used by the sender. 

27. (original) The method of claim 26 wherein the values 
represent one of the following: 

a) message counts; or 

b) ratings of unique users within the network. 

28. (previously presented) The method of claim 26 further 
comprising at least four of the values being returned to the 
recipient to allow the recipient to apply different weights to 
a message in order to categorize the message. 
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29. (original) The method of claim 1 further comprising 
evaluating an unknown sender based on statistics of one of the 
following : 

a) a known final IP address used by the sender; or 

b) a known final domain name used by the sender. 

30. (currently amended) The method of claim 1 further 
comprising evaluating an unknown sender using either a known 
final IP address or a known final domain name based on 
statistics about other new senders using either the known 
final IP address or the known final domain name . 

31. (original) The method of claim 1 further comprising 
giving an unknown final IP address or final domain name an 
initial good rating. 

32. (original) The method of claim 1 further comprising 
giving an unknown final IP address or domain name an initial 
rating based on the length of time the network has been in 
operation. 

33 . (previously presented) The method of claim 1 further 
comprising using message ratings of earlier members of the 
network to overwrite the message ratings of later members of 
the network when the message ratings of the later members of 
the network are inconsistent with the message ratings of the 
earlier members of the network. 
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34. (original) The method of claim 23 wherein a final message 
score is determined by one of the following: 

a) an average of two scores for a message; or 

b) a product of two scores for the message; 
wherein the scores for messages are based on statistics 

associated with a least two of the following: 

i) an actual sender of the message; 

ii) a final IP address used by the sender; 

iii) a final domain name used by the sender; or 

iv) an IP path used by the sender. 

35 . (previously presented) The method of claim 46 wherein 
personal statistics are checked at the local database before 
global statistics at either the central database or the at 
least two centrally-maintained databases are checked. 

36. (previously presented) The method of claim 1 further 
comprising rating a sender by: 

a) releasing a small number of a sender's messages to 
recipients; and 

b) monitoring a classification of the sender's messages 
received from the recipients. 

37 . (previously presented) The method of claim 1 further 
comprising changing a first user's rating when a plurality of 
other users outvote the first user's rating. 

38. (previously presented) The method of claim 44 wherein one 
or more of the at least one database returns more than one 
value of ranking to the recipient. 
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39. (original) The method of claim 1 further comprising 
monitoring the inbox at predetermined intervals to determine 
whether messages should remain in the inbox. 

40. (original) The method of claim 23 wherein a first score 
for an unknown sender using a known final IP address or final 
domain name may be obtained by multiplying a second score for 
the final IP address or final domain name by a number less 
than one . 

41. (original) The method of claim 1 further comprising 
categorizing a received message that cannot be rated locally 
when user activity is observed. 

42. (previously presented) The method of claim 1 further 
comprising using a subsequent formula to compute a score for 
the message when the message is reevaluated, wherein the 
subsequent formula differs from a first formula used to 
compute the previous message score. 

43 . (previously presented) The method of claim 1 further 
comprising sending the recipient a notification when any 
sender's reputation changes. 

44. (currently amended) The method of claim 1 further 
comprising : 

maintaining at least one database; and 
Delecting including in the at least one database to 
include one of the — following; 

a) a central database; 

b) at least two centrally-maintained databases; 

and 

c) a local database. 
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45 . (previously presented) The method of claim 44 further 
comprising storing the received information in the at least 
one database . 

46. (previously presented) The method of claim 44 further 
comprising maintaining the calculated statistics in the at 
least one database. 
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